1. Field of the Invention
The present invention relates to the field of secure forms of computer communications and more particularly to secure forms of computer communications for multiple clients sharing a single network address.
2. Description of the Related Art
Internet security has increasingly become the focus of information technologists who participate in globally accessible computer networks. In particular, with the availability and affordability of broadband Internet access, even within the small enterprise, many computers and small computer networks enjoy continuous access to the Internet. Notwithstanding, continuous, high-speed access is not without its price. Specifically, those computers and computer networks which heretofore had remained disconnected from the security risks of the Internet now have become the primary target of malicious Internet hackers, crackers and script kiddies, collectively referred to as “malicious hackers”.
Notably, many such unauthorized intruders continuously scan the Internet for Internet Protocol (IP) addresses and ports of vulnerable computers communicatively linked to the Internet. At the minimum, those vulnerable computers can experience nuisance damage such as accessed, deleted or modified files or defaced Web pages. Yet, at the other extreme, for the unsuspecting end-user their computer can become the staging area for “zombies” with which more malicious attacks can be launched resulting in the crippling of whole segments of the Internet.
To address the vulnerability of computing devices exposed to the global Internet, information technologists have deployed network address translation (NAT) and network port address translation (NAPT) technologies deployed as a firewall. NAT technologies map a publicly known network address to a privately known address within a private network. In this way, external intruders cannot directly access private network devices as the private network address can be shielded from the external intruder through the proxy action of NAT. The use of NAT, however, requires a one-to-one correspondence between private and public address. To economize on the cost of a single public network address (which can be expensive), a NAPT configured firewall can act similarly to NAT excepting that a single public address can map to multiple private devices which can be distinguished by unique port assignments behind the firewall.
While NAPT and NAT enable security for devices behind the firewall, NAPT and NAT can do little to secure data in transit between source and destination nodes in the Internet. To provide true, end-to-end security for data in the Internet, secure communications must be employed. The Internet Security Protocol, known in the art as “IPsec” represents a common form of secure communications for use over the Internet. In IPsec, communications between source and destination nodes in the Internet can be administered in accordance with a security association (SA). An SA can include one or more rules that define the IPsec processing that is applied to the communication. IPsec is defined in the Request for Comment (RFC) 2401 among other RFCs.
In IPsec, whether the transmission of a packet is denied or permitted with or without IPsec processing is determined by matching the attributes of a packet within the security rules in a security policy database (SPD). To make this determination, both the static rules of a security policy and dynamic rules negotiated as part of an Internet Key Exchange (IKE), each which refers to an SA as described in RFC 2401, can be subjected to a filtered search in the order of most specific to least specific attributes for both outgoing and incoming packets. The filtering of the attributes of a packet within the security rules can be based upon the source and destination address for the paired nodes engaging in secured communications.
For a more complete explanation of the filtering process, U.S. Pat. No. 6,754,832 to Godwin et al. for SECURITY RULE DATABASE SEARCHING IN A NETWORK ENVIRONMENT (Godwin) describes in detail the process of locating a security rule during IPsec processing. Specifically, as described in Godwin, IPsec rules are filtered according to attributes assigned to the rules. The attributes include the source Internet Protocol (IP) address, destination IP address, source port, destination port and protocol. Each dynamic rule contained in the dynamic rules specifies values for all five attributes, hereinafter referred to as the 5-tuple. The static rules include placeholders for sets of dynamic rules. Dynamic rules generally can be searched only if a placeholder is the first matching rule in the static table.
The base standard for applying IPsec with NAT traversal is described in RFC 3947 and RFC 3948. In these documents, a general incompatibility is discussed as between IPsec and NAT traversal. Yet, a more specific inability of IPsec and NAT traversal to support the processing of multiple SAs from multiple clients with the same 5-tuple follows. In particular, inasmuch as IPsec filters the attributes of a packet within security rules in an SPD based upon the source and destination address for paired nodes, the sharing of a single network address for a node can produce ambiguities in the filtering process as SAs for different clients behind an NAPT platform can produce the same 5-tuple.